It's not victimless, the loser is the service provider whose bandwidth is consumed. The line many draw is that corporations aren't people and can't be the victim, this is a false analogy.

Thus: let's switch who is penalized: everyone else on the flight. Bandwidth isn't unlimited, without payment it's hard to justify increasing bandwidth if it isn't profitable.

What should the author do? Report it. If he didn't, maybe you can submit it to the company. If they have a bug bounty, you may get paid (if this happens: would you give the money to the original author?)

If you run a company: you should determine how to insensitivise reporting, it's possible in this case: not fixing it spreads awareness, most people can't/don't exploit it.

> "Thus: let's switch who is penalized: everyone else on the flight."

Only if everybody else on the flight was paying for WiFi (doubtful) and bandwidth was maxed out during the flight (plausible.)

Correct, I failed to clarify it penalized the paying users IF bandwidth was maxed out.

Name the victim, please.

Because it looks like it causes a infinitesimal harm to a corporation whereby no person is harmed to any noticeable extent, aka a victimless crime.

"Victimless crime" doesn't mean there are no negative effects, it means no _person_ is a victim.

Every user who bears the additional cost of the service because of freeloaders is a victim.

Your working definition sounds like it's wrong: Could you give an example of what you call a "victimless crime"?

Have you tried Wikipedia?